CVE-2026-34426: OpenClaw: env var normalization flaw bypasses exec approval

HIGHCISA: TRACK*

Published April 2, 2026

CISO Take

CVE-2026-34426 is an approval bypass in the OpenClaw AI agent: the approval path and the execution path normalize environment variables differently, so non-portable keys that the operator never sees during review are still applied when the command runs. That lets an attacker slip in variables such as PATH-style overrides, which can steer execution toward attacker-controlled binaries while the human-in-the-loop check reports nothing unusual. Risk is moderate: CVSS is 7.6 with network reach and low complexity, but it needs a low-privileged account and user interaction. EPSS is not available, the CVE is not in CISA KEV, and there is no public exploit or Nuclei template. Blast radius through packaging is small (3 downstream dependents), but OpenClaw is a widely deployed agent, and the tracker lists 583 other CVEs in the same package, which points to a weak security track record. Update to a build that includes commit b57b680 (PR 59182), and treat agent approval prompts as untrusted until you have confirmed the fix.

Sources:NVDGitHub AdvisoryATLASvulncheck.comgithub.com/openclaw/openclawAI Incident Database

What is the risk?

Medium-high. CVSS 7.6 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N). Exploitation needs a low-privileged foothold and an operator interaction, which limits mass exploitation. Scope is changed because the bypass defeats a security boundary (operator approval) and affects execution outside that component. Integrity impact is high, since attacker-controlled environment variables can alter which binaries run. No KEV listing, no public exploit, no Nuclei template and no EPSS score, so there is no evidence of in-the-wild exploitation. Package-level signals are weak: 583 other CVEs in the same package, OpenSSF Scorecard unavailable, and a package risk score of 0/100 that should not be read as reassurance. Confidence: MEDIUM, because affected and patched version ranges are not published in structured form.

How does the attack unfold?

Initial Access

Attacker obtains a low-privileged account or influences task input to the OpenClaw agent.

AML.T0049

Approval Bypass

Crafted environment variables with non-portable keys are discarded during approval normalization, so the operator reviews a clean-looking command.

AML.T0107

Execution

The execution path accepts the injected variables and runs an attacker-controlled binary with the agent's privileges.

AML.T0050

Impact

Attacker steals credentials, alters files or establishes persistence on the agent host.

AML.T0112.000

Initial Access

Attacker obtains a low-privileged account or influences task input to the OpenClaw agent.

AML.T0049

Approval Bypass

Crafted environment variables with non-portable keys are discarded during approval normalization, so the operator reviews a clean-looking command.

AML.T0107

Execution

The execution path accepts the injected variables and runs an attacker-controlled binary with the agent's privileges.

AML.T0050

Impact

Attacker steals credentials, alters files or establishes persistence on the agent host.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents32% patched~7d to patchFull package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.6 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 19% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UIRequired

SChanged

CLow

IHigh

ANone

What should I do?

1 step

1) Upgrade OpenClaw to a release that contains commit b57b680c0c34de907d57f60c38fb358e82aef8f7 (PR 59182); check GHSA-98ch-45wp-ch47 for the fixed version, since the structured range is not published. 2) Until patched, disable or restrict auto-approval, and do not approve commands from untrusted sessions or untrusted skill and tool output. 3) Run agents in sandboxed containers or low-privilege accounts with a minimal, fixed environment, and block inherited variables such as PATH, LD_PRELOAD, NODE_OPTIONS and PYTHONPATH. 4) Use allowlists for executable paths (absolute paths) and keep directories writable by the agent out of PATH. 5) Detection: log and compare the environment passed to child processes against what was shown at approval time; alert on child processes launched from unexpected directories and on agent-spawned processes with non-standard environment keys. 6) Inventory OpenClaw installs, including developer machines, and review the agent's approval logs for the period since publication on 2026-04-02.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassCode ExecutionAgentFrameworkAML.T0050- Command and Scripting Interpreter AML.T0053- AI Agent Tool Invocation AML.T0107- Exploitation for Defense Evasion AML.T0112.000- Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 14-Human oversight

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Procedures to respond to and recover from unknown risks

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-34426?

Is CVE-2026-34426 actively exploited?

No confirmed active exploitation of CVE-2026-34426 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-34426?

1) Upgrade OpenClaw to a release that contains commit b57b680c0c34de907d57f60c38fb358e82aef8f7 (PR 59182); check GHSA-98ch-45wp-ch47 for the fixed version, since the structured range is not published. 2) Until patched, disable or restrict auto-approval, and do not approve commands from untrusted sessions or untrusted skill and tool output. 3) Run agents in sandboxed containers or low-privilege accounts with a minimal, fixed environment, and block inherited variables such as PATH, LD_PRELOAD, NODE_OPTIONS and PYTHONPATH. 4) Use allowlists for executable paths (absolute paths) and keep directories writable by the agent out of PATH. 5) Detection: log and compare the environment passed to child processes against what was shown at approval time; alert on child processes launched from unexpected directories and on agent-spawned processes with non-standard environment keys. 6) Inventory OpenClaw installs, including developer machines, and review the agent's approval logs for the period since publication on 2026-04-02.

What systems are affected by CVE-2026-34426?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, human-in-the-loop approval workflows, autonomous coding and tooling agents, CI/CD runners with AI agents.

What is the CVSS score for CVE-2026-34426?

CVE-2026-34426 has a CVSS v3.1 base score of 7.6 (HIGH). The EPSS exploitation probability is 0.27%.

What is the AI security impact?

Affected AI Architectures

agent frameworkshuman-in-the-loop approval workflowsautonomous coding and tooling agentsCI/CD runners with AI agents

MITRE ATLAS Techniques

AML.T0050Command and Scripting Interpreter

AML.T0053AI Agent Tool Invocation

AML.T0107Exploitation for Defense Evasion

AML.T0112.000Local AI Agent

Compliance Controls Affected

EU AI Act: Art. 14

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw versions prior to commit b57b680 contain an approval bypass vulnerability due to inconsistent environment variable normalization between approval and execution paths, allowing attackers to inject attacker-controlled environment variables into execution without approval system validation. Attackers can exploit differing normalization logic to discard non-portable keys during approval processing while accepting them at execution time, bypassing operator review and potentially influencing runtime behavior including execution of attacker-controlled binaries.

Exploitation Scenario

An attacker with a low-privileged account on a shared OpenClaw deployment, or one who can influence the agent's task input, crafts a request that includes environment variables with non-portable keys, for example a PATH override pointing to a writable directory holding a malicious binary named like a common tool. The approval path drops those keys, so the operator sees what looks like a normal command such as a build or git step and approves it. At execution time the agent accepts the variables, resolves the command to the attacker's binary and runs it with the agent's privileges. The attacker then reads tokens and API keys from the host, or plants persistence, all behind a legitimate approval record.

Weaknesses (CWE)

CWE-184Incomplete List of Disallowed Inputs

CWE-184 — Incomplete List of Disallowed Inputs: The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

[Implementation] Do not rely exclusively on detecting disallowed inputs. There are too many variants to encode a character, especially when different environments are used, so there is a high likelihood of missing some variants. Only use detection of disallowed inputs as a mechanism for detecting suspicious activity. Ensure that you are using other protection mechanisms that only identify "good" input - such as lists of allowed inputs - and ensure that you are properly encoding your outputs.

Source: MITRE CWE corpus.